WP Manifestindependent plugin directory
manifest / integrations / ipn-adapter

IPN-Adapter WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

Connect Digistore24 with Brevo to add buyers to mailing-lists

★ 0stars
29release downloads
v1.2.2latest · 10mo ago

Install

Download ipn-adapter-v1.2.2.zip From the v1.2.2 release on GitHub, Dec 7, 2025

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/ulfk/ipn-adapter/releases/download/v1.2.2/ipn-adapter-v1.2.2.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

WP Plugin to connect Digistore24 IPN to Brevo

This is a solution to connect Digistore24 with Brevo to add buyers to mailing-lists.

Why?

Digistore24 currently does not support Brevo natively. So if you want to add buyers of your products to your mailing-lists, there is currently no easy (and free of extra charge) way to do this. So we had to find another solution. As there already was a website based on Wordpress involved, the easiest way was to write a small plugin for Wordpress, that acts as proxy between Digistore24 and Brevo.

How does it work?

The IPN-Adapter plugin provides an endpoint that acts as proxy. When a purchase is done on Digistore24, it will call the IPN-Adapters endpoint. The endpoint will transform the data, received from Digistore24, to the data needed for Brevo. The IPN-Adapter will then add the buyers e-mail address as contact in Brevo and will add that e-mail address to the configured mailing lists.

Important: To get this plugin running, your Wordpress server needs to have a static IP-address or at least an IP-address from a static range. This is because Brevo secures their API by IP whitelisting which is described here. Check your hosting provider to find out, if your Wordpress server fulfills this requirement.

The following picture shows a graphical overview on how the IPN-adapter works: IPN-Adpater Overview

If you install this plugin in your Wordpress, the endpoint that you need to configure in Digistore24, will be https://<YOUR-SERVER>/wp-content/plugins/ipn-adapter/endpoint.php. To add this plugin to your Wordpress, download the zip-file from the latest release and upload it to your Wordpress.

Setup of IPN-Adapter

Open the settings-page IPN Adapter in the Wordpress Settings menu and set the values accordingly.

Field Description
Adapter endpoint for Digistore24 The adapter endpoint URL, you need to set in Digistore24, is displayed. You can copy it the the clipboard by clicking on the clipboard-icon.
Be sure to configure POST as method in Digistore24.
Digistore24 Secret The password you choose and set in Digistore24 for the IPN.
API Key The API key from Brevo
Newsletter List ID Brevo list ID of your newsletter list.
Firstname field The IPN-adapter will send the firstname of the buyer in an attribute with the given name
Lastname field The IPN-adapter will send the lastname of the buyer in an attribute with the given name
Product ID Mapping Map Digistore24 product IDs to specific Brevo list IDs as needed

View Logs

The plugin writes logs to a file in the uploads-folder. Via the menu entry IPN Logs in the Tools menu, you can view those logs.

Digistore24 hints

  • Add a generic IPN.
  • Be sure to deactivate grouping of calls.
  • This plugin has not been tested with any AddOn products.
  • Currently the endpoint only processes "on_payment" events. All other IPN events will be ignored for now.
  • The plugin-endpoint will return OK to Digistore in case of success.

Brevo hints

  • Be aware that you need to add the IP-address of your Wordpress-server to the allowed addresses for API calls.
  • Maybe you want to send other or more attributes to Brevo. You can change/add your attributes in the $attributes array in ipn-adapter.php.

Bookmarks

Releases

12 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v1.2.2 latest
Dec 7, 2025 10mo ago
ipn-adapter-v1.2.2.zip
10
Dec 6, 2025 10mo ago
ipn-adapter-v1.2.0.zip
2
Aug 23, 2025 1 year ago
ipn-adapter-v1.1.3.zip
6
Aug 23, 2025 1 year ago
ipn-adapter-v1.1.2.zip
0
Aug 17, 2025 1 year ago
ipn-adapter-v1.0.2.zip
1
Aug 17, 2025 1 year ago
ipn-adapter-v1.0.1.zip
1
Aug 17, 2025 1 year ago
ipn-adapter-v1.0.0.zip
1
Aug 15, 2025 1 year ago
ipn-adapter-v0.4.1.zip
0
Aug 15, 2025 1 year ago
ipn-adapter-v0.4.0.zip
3
Aug 15, 2025 1 year ago
ipn-adapter-v0.3.0.zip
4
Aug 15, 2025 1 year ago
ipn-adapter-v0.1.2.zip
0
Aug 15, 2025 1 year ago
ipn-adapter-v0.1.1.zip
1
D+ grade

Security

IPN-Adapter 1.2.2 · audited by WP Registry

High-severity findings.

2 high
Audited release
1.2.2
Findings
2
Worst severity
high
Content hash
8e3f95d8eaf89bb246a28cdc…

Findings

  • high IPN signature bypass via loose comparison / empty secret

    auth_bypass

    endpoint.php accepts JSON bodies (json_decode(..., true)) and passes the merged data to has_valid_signature(), which compares the computed SHA-512 hex string to the attacker-supplied sha_sign with ==. Supplying a JSON boolean true for sha_sign makes the comparison true regardless of the secret. Independently, when DIGISTORE_SECRET is not configured (default ''), calculate_digistore_signature() returns the fixed string 'no_signature_passphrase_provided', which also validates. An unauthenticated attacker can therefore forge on_payment events that upsert arbitrary contacts (updateEnabled=true) into the per-product and newsletter Brevo lists using the site's Brevo API key, poisoning lists, triggering buyer/product-delivery automations and overwriting existing contacts' attributes.

    digistore.php:13-16,64-72

    Recommendation

    Require a non-empty secret (fail closed), cast sha_sign to string and compare with hash_equals(), and only accept the transport Digistore actually uses (form POST).

  • high Buyer PII from every IPN logged to a public uploads file

    information_disclosure

    Log_Viewer writes to wp-content/uploads/ipn-adapter/ipn-adapter.log (predictable path, no .htaccess, index file or random name) and endpoint.php logs print_r($data) of every incoming IPN plus the data sent to Brevo, i.e. buyer e-mail addresses, first/last names, addresses and order IDs. Any unauthenticated visitor can download the full log over HTTP.

    logging.php:11-24,357-373

    Recommendation

    Store logs outside the web root (or protect with deny rules and a random filename), and avoid logging full payloads/PII.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.